The three verbs
Every rule in a policy is one of three verbs: deny, allow or ask. Deny is the default for everything you did not grant.
A minimal policy
files: read: [~/Documents] write: [] network: allow: [api.openai.com] spend: max_daily: 2.00 USD
This agent may read one folder, call one host and spend two dollars a day. Nothing else.
Enforced locally
The policy lives on the device and is checked before every action - offline included. The control plane cannot be used to override a denial.
Iterate safely
Start with deny-everything, run a task in ask mode and promote the actions you trust. Every change is logged with a reason.
Next
Learn capability grants to scope power precisely.
RemoteAgent Online - 100 solutions · Blog · mona.expert · Sign in free